STATE OF MICHIGAN 
67TH DISTRICT COURT 


SEARCH WARRANT 


CASE NO. 2019 Flint Water Crisis 
POLICE AGENCY Department of 
Attorney General 
REPORT NO. 2019-FWCT 


TO THE SHERIFF OR ANY PEACE OFFICER: 


A. PERSON, PLACE, or THING to be searched is described as and located 
at: 

The Department of Attorney General, State Operations Division, 

525 West Ottawa, 

G. Mennen Williams Bldg., Lansing, MI 48909 

B. PROPERTY to be searched for and seized, if found, is specifically 
described as: 

1. All unredacted State of Michigan (SOM) Data related to the Flint Water Crisis 
Investigation (FWCI) that is stored at premises owned, maintained, controlled, 
leased, rented, or operated by the Service Provider, KLDiscoveiy. The Service 
Provider, KLDiscoveiy is required to disclose the following information to the 
State of Michigan Solicitor General or a member of the Flint Water Crisis 
Investigation Team: 

2, All original information, data, or files, whether electronic or paper, that were 
provided to the Service Provider, KLDiscoveiy, by any State of Michigan 
representative for potential inclusion in either of the workspaces described above. 


3. All SOM Data and all associated available metadata, including metadata 
described in Appendix A, if available. The SOM Data including both source native 
files and images, plus associated metadata is to be provided in the industry 
standard Concordance format of .dat and .opt, also known as a Relativity Load 
File. 
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4. All necessary information in order to install the Relativity Load File into a new 
Relativity workspace, including but not limited to usernames, passwords, Load 
File field descriptions, etc. will be seized at the time the warrant is executed. 


IN THE NAME OF THE PEOPLE OF THE STATE OF MICHIGAN: I have found that probable 
cause exists, and you are commanded to make the search and seize the described property. Leave a 
copy of tilts warrant with attached tabulation (a written inventory) of all property taken with the 
person from whom the property was taken or at the premises. You are further commanded to 
promptly return this warrant and tabulation to the Court. 
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EXHIBIT A - TYPES OF METADATA 


Field Name 

Example 

Description 

BEGDOC 

EDC00000001 

Unique beginning number for 
each record. 

ENDDOC 

EDC00000002 

Unique ending number for 
each record. 

ATTACHRANGE 

EDC00000001-EDC00000008 

includes the BEGDOC of the 
parent record and the 
ENDDOC of the last 
attachment record, separated 
by a hyphen 

BEGATTACH 

EDCOOOOOOOl 

The unique BEGDOC number 
for the first attached record. 

ENDATTACH 

EDC00000008 

The unique ENDDOC number 
for the last attached record. 

ATTACH 

Attachi.doc; Attacl12.xls 

For parent records - lists the 
original filenames of all 
attached records, separated 
by the multi-value delimiter. 

NUMATTACH 

2 

For parent records - total 
number of records attached. 

ATTACHMT 

EDCooooooo2;EDCooooooo3 

For parent records - lists of 
BEGDOC numbers for all 
attached records, separated 
by the multi-value delimiter. 

MD5HASH 

D564668821C34200FF3E32C9BF 

DCCC80 

Unique MD5 hash value for 
the record. 

CUSTODIAN 

Smith, John 

Person from whom the 
document originated or the 
place/system from where the 
document was collected. 

ALTCUSTODIAN 

Joe Wilson; Bob Smith; John Doe 

List of custodians where the 
record has been removed as a 
duplicate of the one being 
produced. 

RECORDTYPE 

LOOSE E-MAIL 

Phe type of document, such 
as, Image, E-Mail, Loose E- 
Mail, Attachment, eDoc, etc. 

APPLICATIONNAME 

MICROSOFT OFFICE WORD 

Native application used to 
access file, pulled from 
metadata of the native file. 

























DOCEXT 

XLS 

The original file extension of 
the record. 

FILENAME 

Estimates.xls 

-or- 

FW: Monday Meeting 

For native files: The original 
file name of a native file 

For Email records: Subject of 
e-mail message 

FILESIZE 

27739 

Size of the original native file, 
in bytes. 

AUTHOR 

John Smith 

Author field from the 
metadata of the native file. 

EDSOURCE 

C: \Mail\Outloolc.pst 
-or- 

C: \Docmnents\Financials 

Fully qualified original path 
to the source folder, files 
and/or mail stores 

EDFOLDER 


For native files: full path to 
source file 

For email records: folder path 
contained within the mail 
store 

LASTAUTHOR 

Joe L. Smith 

Last save by author from 
metadata of the native file. 

DATESENT 

10/12/2010 

Sent date of an email 
message. 

DATERCVD 

05/22/2011 

Received date of an email 
message. 

DATECREATED 

09/18/2010 

Creation date of a native file. 

DATELASTMOD 

02/11/2012 

Date the native file was last 
modified. 

DATEACCESSED 

11/23/2010 

Date the native file was last 
accessed. 

DATELASTPRNT 

02/13/2011 

Date the native file was last 
printed. 

DATEAPPSTART 

03/05/2012 

Appointment start date for 
calendar items. 

DATEAPPEND 

03/05/2012 

Appointment end date for 
calendar items. 

TIMESENT 

07:05:12 

Sent time of an email 
message. 

TIMERCVD 

10:22:54 

Received time of an email 
message. 

TIMECREATED 

02:45:23 

Creation time of a native file. 


























TIMELASTMOD 

35:12:14 

Time the native file was last 
modified. 

TIMEACCESSED 

11:12:43 

Time the native file was last 
accessed. 

TIMELASTPRNT 

10:34:12 

Time the native file was last 
printed. 

TIMEAPPSTART 

38:00:00 

Appointment start time for 
calendar items. 

TIMEAPPEND 

39:00:23 

Appointment end time for 
calendar items. 

TIMEZONEPROC 

(GMT -05:00) Eastern Time 

Time zone where record was 
first processed 

FROM 

Jane Smith 

Author of email message. 

TO 

Smith, Jane; LeeW [mailto: 
LeeW@gmail.com] 

Main recipient(s) of email 
message. 

CC 

John Paul [mailto: 

ohn_paul@gmail.com] 

Recipient(s) of “carbon 

copies” of email message. 

BCC 

Mary Doe 

Recipient(s) of “blind carbon 
copies” of email message. 

EMAILSUBJECT 

Board Meeting Minutes 

Subject of an email message. 

CONVERSATIONIND 01C72AC4CB0FC3953C5FA8E149 
EX 389B522E FF595EF9FB 

Email thread identification 
created by the original email 
system 

INTMSGID 

<ooo8o5C2c7ib$75977050$cb 

8306di@MSN> 

Internet Message ID assigned 
to an email message by the 
outgoing mail server. 

NATIVEFILE 

NATIVE/ooi/EDCoooooo23.doc 

Relative path to the original 
native file for a record 

TEXTPATH 

TEXT/ooi/EDCoooooooi.txt 

Relative path to the 

associated text file for a 
record 























